North Korean Threat Actors Use AI-Enabled IT Worker Scams and Target Crypto Firms

Microsoft-linked reporting says North Korean threat actors are using AI to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain authorized access inside victim organizations. The activity is attributed to DPRK-linked clusters Jasper Sleet and Coral Sleet, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.”

Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against cryptocurrency organizations spanning staking platforms, exchange software providers, and exchanges, with theft of source code, private keys, and cloud secrets. Investigators described two primary access paths: exploitation of CVE-2025-55182 in the React2Shell framework (including mass scanning and WAF-bypass techniques) and the use of pre-obtained valid AWS access tokens to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.